CISA adds CVE-2026-104286 to KEV; vulnerable and exploited FortiMail requires patch

The US Agency for Infrastructure and Cybersecurity. USA (CISA) has included in its catalogue of known and exploited vulnerabilities (KEV) a zero-day failure in Fortinet FortiMail that is already being exploited in real environments. The failure, recorded as CVE-2026-104286 (CVSS 9.8), allows an unauthenticated attacker to write arbitrary files in the underlying system through manipulated HTTP / HTTPS requests. CISA added the entry after receiving reports of active exploitation, so the official recommendation is to apply patches or mitigations with the highest priority.

In technical terms, Fortinet describes vulnerability as a combination ofpath traversal(inadequate limitation of a route to a restricted directory) and a NULL neutralization failure. In practice this means that a specially constructed input can be removed from the intended directories tree and be truncated or manipulated with a zero character to induce the server to write in arbitrary files. This remote writing capacity is often sufficient to install persistent components - for example shared or binary libraries - that then allow code execution with service privileges affected. This technical explanation coincides with the artifacts identified in reported incidents: libraries, binaries added and changes have been observed in critical dynamic load files such as / data / etc / ld.so.preload, a classic vector to achieve persistent execution.

Facts confirmed: CISA included the CVE-2026-104286 in its KEV catalogue and reported active exploitation; Fortinet published a notice identifying the cause as traversal + NULL character; vulnerability affects multiple branches of FortiMail (detailed by Fortinet) and the company has published temporary recommendations for certain launches. Fortinet also provided commitment indicators (IOCs) associated with observed campaigns: two IP addresses (79.141.169 [.] 187 and 45.129.0 [.] 192) and a list of modified or added files, including / data / lib / liblog.so, / data / bin / webconsole, / data / bin / mailservice, / data / etc / ld.so.preload and / bin / smit.

Current estimates and information: the relationship between file writing capacity and code execution is not specified by Fortinet textually, but the observed files and modifications (especially ld.so.preload and binary added) are consistent with attempts to obtain persistence and remote control. There is no public confirmation, as far as official sources allow, of which actors are behind the holdings or of the quantified overall scope of committed systems; this remains evolving information and depends on the reports being provided by the owners of the affected equipment.

The list of affected versions provided by Fortinet indicates that FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8 and branch 7.2.0-7.2.9 are at risk (for the latter the recommendation is to migrate to branch 7.4 or higher). Fortinet announces patch versions that correct the problem (e.g. 8.0.2, 7.6.7, 7.4.9 or migration to 7.4 in the case of 7.2.x) and proposes temporary mitigation for facilities that cannot be updated immediately, including disabling IBE functionality and restricting Internet management access.

For security organizations and administrators this has direct implications: FortiMail is a mail gateway that processes incoming and outgoing messages; a compromised device can allow for mail interception, data exfiltration, back door deployment or pivoting to the internal network. In addition, security and mail applications often have useful privileges in the infrastructure, so their handling can facilitate subsequent attacks such as Ransomware deployment or internal espionage.

Specific measures to be taken by any organization with FortiMail affected at the moment: first, confirm if your device (s) runs a vulnerable version and plan an urgent update to the corrected version indicated by Fortinet. If you cannot park immediately, apply Fortinet's official mitigation: disable the IBE function and blocking or limiting access to the management interface from the Internet, allowing it only from trust management networks. Follow the exact instructions of the manufacturer to run these mitigation (do not improvise commands without checking official documentation).

Second, look for published IOCs: compare the files identified by Fortinet on FortiMail devices to detect additions or modifications (e.g. / data / etc / ld.so.preload, / data / lib / liblog.so, / data / bin / webconsole, / data / bin / mailservice and / bin / smit) and check network connections to the indicated IPs. If any of the artifacts appear on a team, isolate it from the network immediately and proceed with a forensic analysis. On Unix-like servers, check the presence of ld.so.preload and its content, as well as critical binary hashes and timstamps, is a high-value detection action.

Third, establish network containment measures: block at firewall level the known PIs associated with the campaign (79.141.169.187 and 45.129.0.192), apply rules for access to the management console to allow only internal networks and consolidate the registration and retention of access and configuration log to facilitate research. Update signatures and rules in IDS / IPS and EDR tools with available information and share findings with your incident response team.

Fourth, protect the credentials and keys: if there is a suspicion of engagement, round administrative passwords, change certificates and keys that may have been compromised and review service accounts that interact with FortiMail. Restore from verified backup if the integrity of the device is in doubt and document the entire audit process and possible regulatory notification.

Finally, if it belongs to the US federal government. The US or manages critical infrastructure, observe the CISA deadline: federal agencies must park or mitigate before 4 October 2026, a timetable that points to the urgent nature of the threat. For more information and formal warning, see the CISA catalogue: https: / / www.cisa.gov / knowledge-exploited-vulnerabilities-catalog and the technical detail of the CVE at the NVD base: https: / / nvd.nist.gov / vuln / detail / CVE-2026-104286. The Fortinet publications related to PSIRT should also be reviewed to implement the official steps: https: / / www.fortiguardia / psirt.

It is important to frame this incident in a broader trend: in recent weeks multiple failures have emerged in network and security devices (including in Check Point, Arista VeloCloud, F5 BIG-IP, Cisco Catalyst SD-WAN and Citrix NetScaler) that have also been exploited in practice. This suggests that attackers are intensifying campaigns aimed at infrastructure applications, which often receive less operational attention than servers and endpoints, but whose commitment has a high impact on global network security.

In short, treat this CVE as a first-line priority. Confirm versions, apply official patches or mitigations without delay, verify commitment indicators in your FortiMail and related network segments, and coordinate response and research if you detect signs of intrusion. The window to avoid persistent access and large-scale exploitation is rapidly closing; concrete and verifiable actions now significantly reduce the risk of subsequent damage.